// Shipped by imprion-pos-base. The last word on apt policy for a terminal.
//
// WHY THE 99: apt reads /etc/apt/apt.conf.d/* in sorted order, later wins for a
// scalar, and a re-declared LIST appends rather than replaces. Doc 3 §7's
// `50imprion-unattended` therefore cannot override Debian's own
// `50unattended-upgrades`, which sorts after it. Everything below is a setting
// whose value is a safety property of the fleet, so it is stated where nothing
// can append to or overwrite it.
//
// `#clear` is apt's list reset. Without it the Origins-Pattern a terminal ends
// up with has five entries, three of them Debian's, including
// `origin=Debian,codename=${distro_codename},label=Debian` — the whole trixie
// archive.
#clear Unattended-Upgrade::Origins-Pattern;

// What is downloaded (README decision 290): Debian — point release, -updates
// and security — and the Imprion suite the terminal's wave reads. Every
// terminal downloads the same Debian updates; only the Imprion suite differs
// between canary and stable. Origin and Label are what aptly stamps into the
// Release file (`-origin=Imprion -label="Imprion PoS"`), so this pattern and
// the archive have to agree — if they drift, terminals silently stop staging
// Imprion packages and the only symptom is a fleet that never converges.
//
// apt's own `Download-Upgradeable-Packages` (`apt-get -d dist-upgrade`) and the
// agent's refresh-and-download pass download everything upgradable whatever
// this list says; the list is what unattended-upgrades itself fetches.
Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian";
    "origin=Debian,codename=${distro_codename}-updates,label=Debian";
    "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
    "origin=Imprion,label=Imprion PoS";
};

// Nothing installs on apt's timer (README decision 290): the boot install and
// the agent's maintenance-window install are the only two places anything is
// installed. apt.systemd.daily runs `unattended-upgrade` (an install) whenever
// APT::Periodic::Unattended-Upgrade is not 0, and Debian's 20auto-upgrades sets
// it to 1. unattended-upgrades has no `Download-Only` configuration key — only
// the `--download-only` flag — so the interval is the switch. With it at 0 the
// timer still refreshes the index and runs `apt-get -d dist-upgrade`
// (Update-Package-Lists, Download-Upgradeable-Packages). Measured on a lab
// terminal, 2026-10-02: with the key at 1 apt-daily-upgrade.service installed
// a kernel, libssl and imprion-pos-agent-guard at 17:22 in service hours.
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "0";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

// A reboot-requiring update is never followed by a reboot. The agent records it
// as owed; any reboot clears it, and after three days the agent reboots inside
// the site's maintenance window (README decision 290). Nothing here schedules
// one.

// The agent's transaction and the unattended-upgrades timer both take the dpkg
// lock. Doc 3 §8.3 / M4-06 pass `-o DPkg::Lock::Timeout=300` on the agent's own
// command line; this makes the same courtesy the default for everything else on
// the terminal, so a collision waits five minutes instead of failing a staging
// run and looking like a broken update.
DPkg::Lock::Timeout "300";

// A till on a flaky site link should retry rather than report a failed apply.
Acquire::Retries "3";

// The time of the last successful index refresh, whoever ran it — apt's daily
// timer or the agent's own pass. The agent reports its mtime, and "Up to date"
// in the portal is a statement about the index read at that moment (README
// decision 290).
APT::Update::Post-Invoke-Success {
    "touch /var/lib/apt/periodic/imprion-update-success-stamp 2>/dev/null || true";
};
